Zapscape, tracked as CVE-2026-64561, is a reported Linux kernel KVM vulnerability that can allow privilege escalation from a virtual machine guest to its host under specific hardware and nested-virtualization conditions. CloudLinux recommends mitigation or kernel updates based on whether the server runs virtual machines.
What is Zapscape?
According to CloudLinux, Zapscape affects the Linux kernel's KVM code. The reported issue has two attack paths. A tenant with root access inside a guest may be able to obtain root access on an affected host. On some shared-hosting servers that run no virtual machines, an ordinary user or compromised website may create a temporary guest and attack the host kernel.
CloudLinux states that the vulnerability is upstream and therefore may affect multiple Linux distributions. The source reports a Red Hat severity rating of Important and a CVSS 3.1 score of 7.0.
Which conditions are required for exploitation?
CloudLinux reports that both attack paths require nested virtualization to be enabled. The source also identifies affected systems using either an AMD processor or an Intel processor from Ice Lake-SP onward.
CloudLinux reports that a public proof of concept exists, but states that the published proof of concept does not run against CloudLinux-built kernels.
Which CloudLinux versions are reported as affected?
CloudLinux identifies CloudLinux 7h, 8, 8 LTS, 9, 9 LTS, 10, and CloudLinux for Ubuntu 22.04 as affected versions. The source states that CloudLinux 7 is not affected.
Version exposure still depends on kernel build, processor, nested-virtualization configuration, and server role. Version labels alone do not establish whether an individual server is vulnerable.
What mitigation applies to servers without virtual machines?
For servers that run no virtual machines, CloudLinux reports that administrators can unload KVM and block it from loading. The source states that this mitigation can be applied without a reboot.
What mitigation applies to virtualization hosts?
For hosts that run virtual machines, CloudLinux recommends disabling nested virtualization. The source states that this requires a module reload, which may require draining guests or rebooting the host.
What update status does CloudLinux report?
The supplied CloudLinux source reports different remediation status by product and version:
CloudLinux kernel for versions 7h and 8: update available in the beta channel and rolling out to stable.
AlmaLinux kernel for CloudLinux 9: available.
AlmaLinux kernel for CloudLinux 10: in preparation.
TuxCare ELS for CloudLinux 8 LTS and 9 LTS: in preparation.
KernelCare live patch for affected versions: in preparation.
These statuses are time-sensitive. The source identifies its update information as last updated August 7, 2026, at 13:55 UTC.
How can administrators verify remediation?
Administrators can compare the running kernel reported by uname -r with the target version for their kernel stream. Where KernelCare is installed, CloudLinux provides this verification command:
kcarectl –patch-info | grep 'CVE-2026-64561'
A verification result should be interpreted against the applicable kernel stream, server role, processor, and nested-virtualization configuration. The supplied source does not provide target kernel version numbers for every affected stream.
Why does this matter for hosting providers?
A successful guest-to-host exploit could affect the host and other guests running on it. On shared hosting, CloudLinux reports that compromise of a hosted website could provide a path to root access on the whole server when the required conditions are present.
Hosting providers should first identify which servers run KVM guests, whether nested virtualization is enabled, which kernel stream is installed, and whether processor requirements apply. They should then select mitigation or update actions that match each server's role.
What should administrators do next?
Inventory affected CloudLinux versions and kernel streams.
Identify AMD and Intel processor generations.
Check whether nested virtualization is enabled.
Separate virtualization hosts from servers that run no virtual machines.
Apply the applicable KVM mitigation or available kernel update.
Verify the running kernel or KernelCare patch status.
Monitor CloudLinux and distribution advisories for stable updates and revised guidance.
The supplied source is the basis for this article. Independent confirmation of a specific server's exposure requires local kernel, CPU, virtualization, and patch-status evidence.